CVE-2026-14680

Modified Modified - Updated After Analysis

Type Confusion in PostgreSQL Leading to Arbitrary Code Execution

Publication date: 2026-08-13

Last updated on: 2026-08-29

Assigner: PostgreSQL

Description

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-29

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-14680

EUVD

EUVD-2026-57844

Affected Vendors & Products

Vendor	Product	Version / Range
postgresql	postgresql	From 14.0 (inc) to 14.24 (exc)
postgresql	postgresql	From 15.0 (inc) to 15.19 (exc)
postgresql	postgresql	From 16.0 (inc) to 16.15 (exc)
postgresql	postgresql	From 17.0 (inc) to 17.11 (exc)
postgresql	postgresql	From 18.0 (inc) to 18.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This is a type confusion vulnerability in PostgreSQL where improper handling of the 'internal' data type allows any authenticated user to execute arbitrary code with the privileges of the operating system user running the database. The 'internal' type is meant for internal PostgreSQL operations and not direct SQL access, but safeguards against misuse had gaps.

Detection Guidance

Detecting this vulnerability requires checking PostgreSQL versions against affected releases. Run 'postgres --version' or check package managers like 'apt list --installed | grep postgresql' or 'yum list installed postgresql-server'. If your version is below 18.5, 17.11, 16.15, 15.19, or 14.24, the system is vulnerable.

Impact Analysis

An attacker could gain full control over the database server, leading to unauthorized data access, modification, or deletion. They could also execute system-level commands, potentially compromising the entire host system.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Immediately update PostgreSQL to the latest patched versions: 18.5, 17.11, 16.15, 15.19, or 14.24. If updating is not possible, restrict database access to trusted users only and avoid using functions with 'internal' data type arguments until patched.

Hi! I’m here to help you understand CVE-2026-14680. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70